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Abstract 

Any  Global  Navigation  Satellite  System  (GNSS)  relies  on  a  highly  stable  and  reliable  System 
Time  that  has  to  meet  high-performance  requirements  to  enable  GNSS  services  suitable  for 
navigation  and  timing  communities.  The  challenge  is  to  guarantee  this  high  performance 
continuously.  The  Kalman  filter  algorithm  implemented  in  GPS,  called  the  GPS  Composite 
Clock,  is  a  mature  method  to  generate  such  a  highly  robust  System  Time.  The  algorithm 
estimates  the  time  offsets  of  every  individual  clock  to  the  so-called  implicit  mean,  which  is  a 
common  component  in  all  clock  estimates.  The  common  component  offers  the  functionality  of 
System  Time  and  is  understandable  as  a  weighted  average  out  of  all  ensemble  clock  readings. 
GPS  Composite  Clock  performance  is  analyzed  by  simulations  of  a  “light”  GNSS  configuration 
with  10  rubidium  satellite  clocks,  including  deterministic  drift,  six  ground  cesium  clocks,  and 
two  ground  active  hydrogen  masers.  Besides  evaluating  the  stability  of  an  error-free  clock 
constellation  to  define  the  regular  performances,  the  behavior  of  the  algorithm  is  investigated 
considering  different  operational  scenarios:  exclusion  of  clocks  from  the  GNSS  ensemble  and 
occurrence  of  clock  feared  events  (frequency  steps  in  rubidium  satellite  clocks  and  ground  11- 
masers). 


INTRODUCTION 

Precise  timing  is  the  backbone  of  all  Global  Navigation  Satellite  Systems  (GNSS)  like  GPS  or  the  future 
Galileo.  Consequently,  the  aim  is  to  establish  a  highly  stable  and  reliable  System  Time  which  fulfills  high 
performance  requirements  to  enable  GNSS  services  suitable  for  navigation  and  timing  communities. 


PERFORMANCE  REQUIREMENTS  ON  GNSS  SYSTEM  TIME 

The  main  purpose  of  System  Time  is  to  provide  a  stable  reference  for  precise  prediction  of  satellite 
clocks.  System  Time  should  only  marginally  affect  the  prediction  error  of  the  time  offsets  compared  to 
the  general  prediction  error  of  the  satellite  clocks  themselves.  To  assess  the  required  stability  of  the 
System  Time,  satellite  clock  prediction  errors  were  simulated  for  six  different  scenarios.  The  scenarios 
assume  a  typical  stability  of  the  Galileo  satellite  rubidium  and  varying  System  Time  stability.  Obviously, 
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the  minimal  prediction  error  is  observed  for  a  perfectly  stable  System  Time.  Here,  the  satellite  clock 
prediction  error  is  not  affected  by  the  System  Time  component  at  all  and  is  equal  to  1.03  ns  (la)  (Figure 
1,  bar  marked  with  “0”).  However,  comparing  this  result  to  scenarios  where  the  System  Time  was  10,  5, 
or  3  times  more  stable  than  the  satellite  clocks,  it  can  be  noted  that  prediction  error  only  marginally 
increases  to  1.08  ns  (la)  for  the  3  times  case  (see  the  bar  marked  with  “3”).  Relating  to  the  simulation 
results,  it  seems  to  be  reasonable  to  require  the  System  Time  to  be  at  least  3  times  more  stable  than  the 
satellite  clocks.  Here,  the  prediction  error  is  only  marginally  disturbed  by  instability  of  the  System  Time 
and  also  the  performance  is  not  distinctly  improved  by  using  a  more  stable  System  Time. 


System  Time  vs.  Satellite  stability 


Figure  1.  Prediction  error  of  different  System  Time  stabilities. 


The  second  function  of  GNSS  System  Time  is  the  support  of  timing  services.  The  System  Time  has  to  be 
closely  steered  to  UTC  and  the  long-term  stability  has  to  be  in  levels  of  10'14.  However,  in  this  paper  we 
concentrate  on  the  navigation-related  (prediction  of  satellite  clocks)  performances. 


ESTABLISHING  SYSTEM  TIME  USING  COMPOSITE  CLOCK 
ALGORITHM 

In  general,  there  are  two  approaches  to  establish  System  Time  that  meet  the  strict  requirements  of 
navigation  and  time  services.  The  first  approach,  called  the  Master  Clock,  is  to  establish  the  System  Time 
using  a  high-quality  atomic  clock,  e.g.  an  active  hydrogen  maser  (AHM).  Its  physical  output  defines 
System  Time  and  all  other  GNSS  clocks  are  referenced  to  it.  This  strategy,  in  which  System  Time  had  a 
physical  representation,  was  used  by  GPS  till  1991  [3].  However,  implementing  System  Time  by  a 
hardware  clock  creates  a  single  point  of  failure,  since  any  Master  Clock  error  like  frequency  or  phase 
jumps,  affects  the  System  Time. 
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The  second  approach  is  using  an  Ensemble  Time  algorithm  to  establish  System  Time.  Such  algorithms 
estimate  time  offsets  of  every  GNSS  clock  with  respect  to  a  “paper”  System  Time  produced  by  the 
algorithm.  In  this  approach,  there  is  no  physical  representation  and  System  Time  is  equal  to  a  weighted 
average  of  all  GNSS  clocks.  Since  1991,  GPS  makes  use  of  a  Kalman  Filter  that  is  called  GPS 
Composite  Clock  (CC)  [1].  Although  the  GPS  Composite  Clock  does  not  depend  on  a  single  clock,  every 
GNSS  clock  contributes  with  a  different  weight  to  the  System  Time.  Hence,  any  clock  error  still  affects 
System  Time  and,  thus,  disturbs  all  other  time  offsets.  These  effects  will  be  investigated  further  in  this 
paper. 

Simulated  GNSS  Clock  Ensemble 

The  robustness  of  GPS  Composite  Clock  using  3-state  clock  models  is  investigated  by  simulating  a 
“light”  GNSS  clock  ensemble  of  10  satellite  rubidium  clocks  and  two  ground  stations,  each  equipped  with 
three  cesium  clocks  and  one  active  hydrogen  maser  (AHM).  Figure  2  shows  the  Allan  deviation  of  clock 
simulations  of  every  clock  type. 


Figure  2.  Stability  of  simulated  clock  readings. 


Further,  we  simulated  clock  measurements  by  referencing  all  ensemble  clocks  to  an  AHM  with  a  sample 
interval  of  15  min  and  adding  White  Gaussian  measurement  noise  of  o  =  0.42  ns  (la).  Obviously,  all 
time  offsets  are  affected  by  the  measurement  noise  in  the  short  term,  and  in  the  long  term  the  stability  of 
Cs  clocks  is  disturbed  by  the  instability  of  the  AHMs  (Figure  3). 

Stability  of  Time  Offsets  with  Respect  to  the  Composite  Clock 

In  order  to  operate  the  GPS  Composite  Clock,  the  individual  clock  process  parameters  qi,  q2  and  q3  are 
derived  from  the  Allan  deviation  of  every  clock  [2].  These  parameters  qi,  q2  and  q3  also  define  the  clock 
weights  in  the  Composite  Clock  algorithm  [1].  Since  the  AHMs  are  almost  100  times  more  stable  at  the 
selected  measurement  interval  (15min)  than  the  other  clocks,  the  filter  implicitly  assigns  almost  all  weight 
in  the  ensemble  to  both  AHMs  (see  Figure  4). 
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Figure  3.  Stability  of  time  offsets  w.r.t.  AF1M. 


Weights  of  CC 
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Figure  4.  Weights  implicitly  assigned  by  the  Composite  Clock  algorithm. 


The  CC  algorithm  iteratively  processes  the  simulated  time  offsets,  which  are  referenced  to  the  selected 
AFIM,  and  computes  time  offsets  with  respect  to  the  implicit  mean  (Composite  Clock).  The  stability  of 
the  computed  time  offsets  is  shown  in  Figure  5.  All  estimates  benefit  from  application  of  the  Kalman 
filter  in  the  short-  and  medium-term,  since  measurement  noise  is  mitigated.  Further,  the  stability  of 
rubidium  and  Cs  clocks  is  unaffected  by  a  Composite  Clock  in  the  short  and  medium  terms,  remaining 
(almost)  equal  to  the  stability  of  these  clocks  in  a  free-running  mode.  Flowever,  the  stability  of  the  Cs 
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clocks  offset  to  the  CC  is  disturbed  by  the  CC’s  instability  in  the  long  term.  Finally,  the  stability  of  both 
AF1M  is  also  disturbed  by  CC’s  short-term  instability. 


Time  differences  to  Composite  Clock 


time  offset  Maser 
time  offset  Caesium 
time  offset  Rubidium 


10 


10  10 
Tau,  s 

Figure  5.  Stability  of  estimated  time  offsets  w.r.t.  Composite  Clock. 


Stability  of  “Corrected”  Clocks 

The  theory  of  GPS  Composite  Clock  outlines  that  the  difference  between  simulated  clock  readings  and 
Kalman  filter  estimates  is  equal  to  the  common  component  Composite  Clock  or  System  Time  plus  a 
(steady-state)  representation  error.  It  is  important  to  mention  that  these  differences  are  usually  called 
“corrected”  clocks  and  are  only  computable  by  simulations,  since  the  true  clock  readings  are  unknown  in 
the  real  world.  Every  “corrected”  clock  represents  Composite  Clock  or  System  Time  with  an  individual 
and  steady-state  representation  error. 

Figure  6  compares  stabilities  of  “corrected”  and  “uncorrected”  cesium,  rubidium,  and  AHM  clocks. 
“Corrected”  cesium  and  rubidium  clocks  behave  similarly  and  are  dominated  by  White  Phase  noise  in  the 
short  and  medium  term.  Only  ’’corrected”  AHM  clocks  are  not  characterized  by  White  Phase  noise  and 
exhibit  White  Frequency  noise  in  the  short  and  medium  term.  However,  the  stability  of  “corrected”  AHM 
clocks  is  worse  than  the  stability  of  “uncorrected”  AHM  clocks. 


IMPACT  OF  CLOCK  FAILURES  ON  THE  COMPOSITE  CLOCK 

An  important  advantage  of  Ensemble  Time  algorithms  is  the  generation  of  System  Time  which  is 
independent  of  one  individual  (Master)  clock.  However,  all  clocks  contribute  to  the  System  Time  and, 
therefore,  individual  clock  failures  affect  System  Time.  Several  failure  cases  are  investigated  below. 


395 


39th  Annual  Precise  Time  and  Time  Interval  (PTTI)  Meeting 


g  10- 


Maser  corr 
Caesium  corr 
RAFS  corr 
Maser  Simulation 
Cesium  siumaltion 
RAFS  simualtion 


2  3  4  5  6  7 

10  10  10  10  10  10 

Tau,  s 

Figure  6.  Stability  of  corrected  vs.  uncorrected  clocks. 
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Loss  of  One  Satellite  Clock 

The  first  test  case  investigates  the  impact  of  a  loss  of  one  satellite  clock  on  the  Composite  Clock.  There 
are  different  methods  to  implement  such  a  clock  removal.  We  have  chosen  to  reduce  the  filter  dimension 
and  to  remove  all  rows  and  columns  of  the  affected  clock  from  the  filter  state  and  covariance  matrix.  The 
estimate  and  covariance  matrix  of  the  last  step  before  the  clock  removal  are  used  to  reinitialize  the 
reshaped  filter. 

In  order  to  assess  the  impact  of  satellite  clock  removal,  the  filter  estimate  including  all  clocks  is 
subtracted  from  the  filter  estimate  with  one  satellite  clock  removed.  At  the  time  of  removal,  this 
difference  averages  to  about  0.15  ps  for  all  clocks  (Figure  7). 

Loss  of  One  Ground  Station 

The  second  test  case  analyzes  the  impact  of  losing  one  monitor  station  (1  AHM  plus  three  Cs  clocks)  on 
the  computed  time  offsets.  Here,  the  difference  in  time  offsets  averages  to  about  5.4  ps  at  the  time  of 
removal  (Figure  8).  The  impact  is  about  30  times  higher  than  the  one  of  the  scenario  when  losing  one 
satellite  clock.  But  it  is  still  at  the  level  of  picoseconds. 
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Loss  of  Satellite  Clock 


□  Oh  □  2h  D24  h 


Figure  7.  Differences  in  time  offsets  after  loss  of  one  satellite  clock. 


Loss  of  Monitor  Station 


|  El  Oh  B2h  D24  h  | 


Figure  8.  Differences  in  time  offsets  after  loss  of  one  ground  station. 
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Frequency  Step  of  a  Satellite  Clock 

The  next  test  cases  focus  on  the  impact  of  clock  feared  events  (in  particular,  frequency  steps)  on  the 
Kalman  filter  estimates.  No  algorithm  modifications  for  this  case  were  implemented.  The  measurements 
disturbed  by  a  clock  feared  event  were  processed  with  the  nominal  Kalman  filter  configuration. 

First,  we  simulated  a  frequency  step  of  10  11  in  one  of  the  satellite  clocks.  Figure  9  compares  the  filter 
frequency  estimates  of  the  affected  rubidium  to  an  unaffected  rubidium.  Obviously,  the  filter  responds  to 
the  frequency  step  and,  after  48  h,  its  estimates  totally  reflect  the  jump  size  of  10'11.  Remarkably,  the 
other  clock  estimates  were  not  significantly  affected. 


Figure  9.  Frequency  estimates  of  two  RAFS:  with  a  frequency  step  and  without. 


Again,  the  impact  is  assessed  by  differencing  the  filter  estimates  without  the  frequency  step  to  the 
estimates  with  the  step.  The  impact  at  the  clocks  without  the  step  averages  about  1  ps  at  one  measure¬ 
ment  step  after  the  event  time  (see  Figure  10). 

Frequency  Step  of  an  Active  Hydrogen  Maser 

The  situation  is  different  if  a  frequency  step  happens  to  a  AF1M  with  high  weight  in  the  CC  algorithm. 
We  analyzed  the  case  when  one  AFIM  is  disturbed  by  a  simulated  step  of  size  5xl0"13. 

Both  AFIMs  respond  to  the  clock  event  and,  after  a  time  interval  of  24  h,  each  of  the  estimates  is  affected 
about  half  of  the  step  size  (Figure  1 1). 

Flowever,  the  filter  smoothes  the  event  and  its  output  does  not  respond  immediately  to  the  event.  The 
impact  of  the  AFIM  frequency  steps  on  the  filter  estimates  of  all  clocks  averages  to  about  10  ps  (Figure 
12). 
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Frequency  step  of  RAFS 

Ino  min  ■  2h  □  24  h  I 


Figure  10.  Differences  in  time  offsets  after  a  frequency  step  applied  to  a  rubidium  clock. 
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Frequency  step  of  AHM 
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Figure  12.  Differences  in  time  offsets  after  a  frequency  step  of  an  AHM. 


CONCLUSION 

The  Composite  Clock  Algorithm  has  been  analyzed  with  a  simulated  GNSS  clock  constellation  of  ten  Rb- 
clocks,  two  AHMs,  and  six  Cs  clocks.  The  choice  of  clock  parameters  qi,  q2  and  q3i  in  accordance  with 
the  clock  stability,  has  put  the  weights  of  both  AHMs  to  almost  100%.  Consequently,  in  the  selected 
simulation  scenario,  two  clocks  (AHMs)  of  the  ensemble  establish  System  Time  and  the  other  clocks  only 
marginally  contribute  to  it. 

The  evaluation  of  the  filter  output  points  out  that  the  short-  and  medium-term  stability  of  rubidium  and 
cesium  clock  offsets  with  respect  to  the  Composite  Clock  (implicit  mean  produced  by  the  Kalman  filter) 
is  very  close  to  the  stability  of  these  clocks  in  a  free-running  mode.  On  the  other  hand,  the  instability  of 
the  AHMs-CC  offsets  is  considerably  higher  compared  to  a  free-running  AHM  due  to  instabilities  of  the 
CC  itself.  Furthermore,  the  instability  of  the  cesium-clocks-CC  offset  is  disturbed  in  the  long  term. 
Hence,  the  Composite  Clock  with  the  used  q-parameter  configuration  is  not  able  to  benefit  from  the  long¬ 
term  stability  of  the  cesium  clocks. 

Besides  applying  the  algorithm  to  an  error-free  clock  constellation,  the  impact  of  different  clock  failure 
scenarios  was  investigated.  First,  we  tested  the  scenario  when  one  satellite  clock  was  excluded  from  the 
ensemble.  The  change  in  time  offsets  averages  about  0.2  ps  and,  thus,  the  exclusion  will  not  affect  the 
prediction  error  of  the  remaining  clocks.  Another  test  case  investigated  the  impact  of  exclusion  of  one 
ground  station  that  includes  one  AHM  and  three  Cs  clocks.  In  this  case,  the  difference  in  time  offsets 
increases  to  about  5  ps  at  the  time  of  exclusion. 
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Besides  evaluating  the  impacts  of  clock  exclusions,  which  was  handled  by  a  controlled  modification  of 
the  ensemble  Kalman  filter  (the  filter  dimension  was  resized  and  the  last  filter  outputs  were  used  to 
reinitialize  the  filter),  a  second  failure  class  was  analyzed:  the  impact  of  clock  feared  events.  These 
events  disturb  the  measurement  inputs  of  the  filter  and  are  processed  by  the  filter  in  a  regular  manner. 

The  first  feared  event  was  a  frequency  step,  which  corresponds  to  a  frequency  change  of  100  times 
compared  to  the  specified  clock  stability  (ADEV@15  min)  at  one  of  the  satellite  clocks.  The  simulations 
outline  that  the  effect  of  this  event  at  the  Composite  Clock  is  non-critical  and  the  change  in  time  offsets  of 
the  remaining  clocks  average  1  ps.  Nevertheless,  the  estimate  of  the  failed  satellite  clock  changes  about  4 
ns  900  s  after  the  event  time  and,  thus,  that  prediction  error  will  be  distinctly  affected. 

The  results  were  quite  different  for  the  case  when  a  high-weighted  AHM  was  disturbed  by  a  frequency 
step.  Here,  every  time  offset  including  the  one  of  failed  AHM  changes  in  average  by  about  10  ps  at  one 
step  after  the  event  time,  and  thus,  the  impact  at  the  clock  prediction  error  should  be  also  non-critical. 
This  behavior  can  be  explained  by  the  observation  that,  first,  the  Composite  Clock  reading  changes  only 
half  of  the  step  size,  due  to  the  assigned  AHM  weight  of  50%  and,  second,  half  of  the  step  size  is 
distributed  by  the  filter  over  a  period  of  24  h.  So  the  change  is  propagated  in  a  steady  fashion  to  the  time 
offsets. 

Further,  it  was  observed  that  the  change  in  time  offsets  of  the  failed  AHM  was  also  about  10  ps  and  its 
behavior  is  similar  to  the  remaining  clocks.  The  argued  reason  for  that  is  that  the  filter  always  estimates 
the  difference  of  every  clock  to  the  Composite  Clock  and,  thus,  both  steps  (the  one  of  the  AHM  and  the 
one  of  the  Composite  Clock)  difference  up  and  results  in  half  the  step  size  of  the  corresponding  time 
offset. 
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